TL;DR: Zero-click prompt injection can evolve from a single-victim leak into a self-replicating worm when malicious prompts are embedded in emails and later reused by retrieval-augmented agents, according to Verno Labs research. The security problem is no longer just exfiltration; it is uncontrolled propagation through trusted AI workflows, where context mixing and outbound actions turn one compromised interaction into a broader campaign.
At a glance
What this is: This analysis shows how zero-click prompt injection can move beyond single-session data leakage and become a self-spreading attack pattern across AI-assisted workflows.
Why it matters: IAM and AI security teams need to treat agent context, tool use, and outbound communication as governance boundaries because one compromised interaction can propagate through systems that were assumed to be isolated.
Context
Zero-click prompt injection is a class of attack where untrusted content is processed by an AI system without any user click or explicit approval. In this article's framing, the risk is no longer limited to a single prompt or a single session, because retrieval-augmented generation and outbound actions can turn one poisoned input into repeated misuse across an AI workflow.
That matters because the security boundary is not the human recipient but the agent's context window, tool permissions, and communication channels. Once an assistant can read, retrieve, and reply from the same trust boundary, the problem becomes one of governance over prompt injection defenses rather than user awareness alone.
Key questions
Q: What breaks when an AI agent can read private data and send it externally?
A: The agent can become an exfiltration path instead of a productivity layer. If attacker-controlled content reaches the agent at the same time as sensitive data and outbound communication tools, prompt injection can turn ordinary workflow actions into disclosure. The failure is architectural, because the agent has enough privilege to act on malicious instructions while appearing legitimate.
Q: Why do zero-click leaks create more risk than ordinary data exposure?
A: Because the user does not need to trigger the disclosure. When an assistant or agent can surface sensitive information through normal retrieval or rendering, classic user-intent controls do not apply. Security teams need to govern retrieval scope, output handling, and delegation boundaries as part of access control.
Q: What are the signs that an AI-integrated workflow is being abused by prompt injection?
A: Look for unexpected outputs, new records that the user did not intentionally create, data summaries appearing in the wrong context, and actions that follow hidden instructions embedded in otherwise trusted content. The key signal is not model failure alone, but unauthorised downstream behaviour that the workflow should never have permitted.
A: Prioritise scoping first. Filters can help, but they are still trying to recognise bad content after it enters the workflow. Scoping reduces the amount of sensitive data an attacker can reach, while hard approval gates and outbound controls stop harmful actions even if the prompt is missed. The article's core lesson is that limiting authority is more reliable than trying to catch every malicious prompt.
Technical breakdown
How self-replicating prompts move through retrieval-augmented generation
A self-replicating prompt becomes dangerous when an assistant stores or retrieves untrusted text as context and then uses that same context to generate an outbound response. In a retrieval-augmented generation setup, the poisoned content does not need to exploit a software bug. It only needs to be included in the retrieval set, where the model can repeat or transform it into a new message. That makes the database of retrieved content part of the attack surface, not just the user prompt. The key architectural failure is that instructions and data share one processing space, so malicious text can survive normal summarization or response generation. See the Agentic AI Security Guide.
Practical implication: Treat retrieved content as untrusted input and separate it from instruction channels before the model can act on it.
Why the lethal trifecta creates propagation risk
The lethal trifecta is the combination of private data access, exposure to untrusted content, and an external communication path. Each capability is individually useful, but together they let an attacker read sensitive context and then push that content back out through an authorized channel. In practice, this is why a single compromised assistant can become a propagation engine instead of a one-off leak. The danger rises further when agents gain tools for browsing, code execution, or financial transactions, because every additional tool can widen either the input side or the output side of the same trust boundary. See the Browser and Computer-Use Agent Security Guide.
Practical implication: Constrain at least one side of the trifecta by limiting data reach, outbound channels, or tool authority.
Why zero-click attacks defeat user-training assumptions
Traditional awareness programs assume the user can notice and avoid the malicious action. Zero-click prompt injection breaks that model because the victim may do nothing unusual at all. The model ingests the content, the client auto-fetches or previews material, and the assistant performs the harmful action on the user's behalf. That means the defect is architectural, not behavioural. If the system allows untrusted content to flow into the same context used for trusted instructions, then no amount of caution from the end user reliably restores the boundary. The control must therefore move into the system design itself.
Practical implication: Move the control point from the user to the platform by enforcing runtime restrictions on what the agent can retrieve, render, and send.
Threat narrative
Attacker objective: The attacker wants to turn one poisoned interaction into repeated data exposure and self-propagating compromise across AI-enabled workflows.
- Entry occurs when malicious content is delivered through email or another untrusted channel and later retrieved by an AI assistant as context.
- Credential or access abuse follows when the assistant is authorized to read private data and generate responses using the same trust boundary.
- Escalation happens when the assistant can also communicate externally, allowing the malicious prompt to be copied into outbound replies and propagated to new victims.
- Impact is broader than a single leak because the attack can spread across AI-assisted workflows and repeatedly expose data or trigger unintended actions.
Breaches seen in the wild
- EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Zero-click prompt injection is becoming a propagation problem, not just an exfiltration problem. The important shift is not the existence of a leaked response but the possibility that the same malicious instruction can be carried forward by the assistant itself. That changes the threat model from one compromised session to a potentially repeating distribution mechanism. Practitioners should treat any AI workflow that reads and writes the same trust boundary as a candidate for containment controls, not just content filtering.
AI agent identity governance now has to account for the agent's outbound authority. Once an assistant can read private context and publish responses, the identity question is no longer only who is authenticated, but what that authenticated system is allowed to disclose or trigger. This is where red teaming AI agents for identity abuse becomes relevant, because the risky condition is the combination of delegated access and external communication. The practitioner implication is to govern the agent as a privileged actor, not a passive interface.
Context contamination is the failure mode this article sharpens. The central governance assumption that fails is that retrieved content is merely data while prompts are the only instructions. In reality, assistants can ingest poisoned content, preserve it in context, and then reuse it as if it were benign. That means the control problem is boundary enforcement between trusted instructions and untrusted retrieval, not only prompt screening. Practitioners need evidence that their architecture can keep those channels separate.
The right response is to reduce the blast radius of every agent session. The article is persuasive because it shows that scoping, approval gates, and runtime logging matter more than trying to detect every malicious prompt. As agents gain more tools, the governance burden shifts from message classification to authority limitation. The field should therefore treat least privilege for AI workflows as a core control, not an optional hardening step.
From our research library:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- Read next: Prompt Injection Guide
What this signals
Context contamination: the security boundary now sits between trusted instructions and untrusted retrieved content, and that boundary has to be enforced before the model can act. In practice, that means organisations should stop treating retrieval-augmented generation as a pure content problem and start treating it as a privilege problem.
The article also reinforces that agent governance must include outbound authority, not just inbound filtering. When the same system can read private data, process hostile content, and communicate externally, the control plane needs blast-radius limits, approval gates, and logging that resembles privileged access oversight.
43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec. That concern fits this threat pattern closely, because propagated prompts can move sensitive context from one workflow into another without a human deliberately sharing it.
For practitioners
- Constrain agent data scope Limit what any single agent session can retrieve before it is asked to summarize, reply, or act so a compromised interaction exposes less context.
- Insert a hard approval gate for high-impact actions Require explicit approval before the agent can send data, execute code, or move money so a malicious prompt cannot quietly complete the action path.
- Disable auto-rendering of remote content Turn off automatic image loading, previews, and other remote fetches anywhere an agent is in the loop because those features can remove the last click and enable zero-click exploitation.
- Log tool calls and outbound requests as privileged activity Treat the agent's actions like privileged account behaviour and retain traces for tool usage, external calls, and unexpected reply generation.
- Test for self-replication across assistant workflows Probe whether malicious content can be copied from one assistant response into another downstream workflow, especially where retrieval-augmented generation reuses prior outputs.
Key takeaways
- Zero-click prompt injection can now behave like a propagation mechanism, not just a data leak.
- The article shows that self-replicating prompts and assistant-to-assistant reuse make the blast radius much larger than a single session.
- Limiting retrieval scope, outbound authority, and auto-rendering is more effective than relying on users to spot malicious content.
Related NHI Mgmt Group resources: Prompt Injection Guide · Red Teaming AI Agents for Identity Abuse · EchoLeak (Microsoft 365 Copilot) 2025 · Agentic AI Security Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI07 — Insecure Inter-Agent Communication | The article centers on malicious content moving between AI systems through outbound replies and reused context. |
| ASI09 — Human-Agent Trust Exploitation | The attack succeeds by exploiting trust between human prompts, untrusted content, and agent actions. | |
| Recommendation — Restrict cross-agent message flow and validate any output that can become another agent's input. Separate trusted instructions from untrusted inputs and require confirmation before high-impact actions. | ||
| MITRE ATLAS | TA0009;TA0010 — Collection; Exfiltration | The threat involves collecting context and pushing it back out through assistant-generated replies. |
| Recommendation — Map agent prompt-injection paths to collection and exfiltration tactics, then hunt for outbound leakage indicators. | ||
| NIST AI RMF | MANAGE — Risk Treatment | The article is fundamentally about managing AI risk through containment and runtime controls. |
| Recommendation — Use AI risk treatment to enforce bounded context, approval gates, and logging for agent actions. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The core issue is excessive agent authority across data access and outbound actions. |
| Recommendation — Apply PR.AA-05 to limit agent entitlements to the minimum needed for each workflow. | ||
Key terms
- Zero-Click Prompt Injection: A zero-click prompt injection is malicious content that influences an AI system without the user deliberately approving or triggering the attack. The risk arises when the model ingests untrusted text as part of the same context it uses for trusted instructions, allowing the attacker to steer outputs or actions silently.
- Retrieval-augmented Generation: Retrieval-augmented generation is a pattern where an AI model pulls external information before generating output. The security challenge is that access rules can weaken when data is chunked, embedded, cached, or reused, so source permissions may not automatically follow the content into the model's context.
- Lethal Trifecta: A risky AI agent condition where one system can read private data, consume untrusted content, and communicate externally. When those three capabilities overlap, the agent can be tricked into disclosing sensitive information through legitimate tools without a conventional exploit.
- Context Contamination: The spread of incorrect, unsafe, or sensitive information through shared memory or context that multiple agents read and reuse. Once contaminated, the state can influence several decisions at once, which makes the issue harder to trace than a single bad output and harder to clean after the fact.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity teams build the control thinking needed to govern AI systems that act with delegated authority.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org